Let’s start by listing all of the current ElasticSearch Indices. From a command prompt on the Graylog box run the following:

curl -X GET "localhost:9200/_cat/indices?v"

Output should look something like this:

 health status index     uuid                   pri rep docs.count docs.deleted store.size pri.store.size
 green  open   graylog_1 U7XiaZBtT1-ZSFiZ8Afr2A   4   0    5566409            0      4.2gb          4.2gb
 green  open   hq1_0     zt6Yqo7AQAqP2OwR1hF3wg   4   0         81            0    185.7kb        185.7kb
 green  open   graylog_0 s33oBg-xQ52Y8OAPFDd-8Q   4   0   20000169            0     14.7gb         14.7gb

Now we’ll have to delete the failed Indices by running the following commands:

  curl -X DELETE "localhost:9200/graylog_1" {"acknowledged":true}
  curl -X DELETE "localhost:9200/graylog_0" {"acknowledged":true}

Now we’ll restart Graylog and Elasticsearch

  sudo systemctl restart graylog-server
  sudo systemctl restart elasticsearch

Now re-list the indices:

curl -X GET "localhost:9200/_cat/indices?v"

And you should see your new indices running.

health status index     uuid                   pri rep docs.count docs.deleted store.size pri.store.size
   green  open   hq1_0     zt6Yqo7AQAqP2OwR1hF3wg   4   0         81            0    185.7kb        185.7kb
   green  open   graylog_0 H2vvP2QtQGig6ZKnXr9StQ   4   0        266            
   0    774.8kb        774.8kb